ta: pkcs11: helper function to serialize object attribute

Helper function to add attributes in serial list of object
attributes in PKCS11 TA.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Rev

ta: pkcs11: helper function to serialize object attribute

Helper function to add attributes in serial list of object
attributes in PKCS11 TA.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
[jw: change return types to enum pkcs11_rc]
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: add id-to-string conversion for new TA commands

Add missing user authentication commands id-to-string conversion.
Add new import/destroy commands id-to-string conversion.

Reviewed-by: R

ta: pkcs11: add id-to-string conversion for new TA commands

Add missing user authentication commands id-to-string conversion.
Add new import/destroy commands id-to-string conversion.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

ta: pkcs11: define TA commands for object creation/destruction

Add commands PKCS11_CMD_IMPORT_OBJECT and PKCS11_CMD_DESTROY_OBJECT
in enum pkcs11_ta_cmd.

Reviewed-by: Ricardo Salveti <ricardo@found

ta: pkcs11: define TA commands for object creation/destruction

Add commands PKCS11_CMD_IMPORT_OBJECT and PKCS11_CMD_DESTROY_OBJECT
in enum pkcs11_ta_cmd.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

ta: pkcs11: add vendor mechanism used for object import

Add PKCS11_PROCESSING_IMPORT and PKCS11_CKM_UNDEFINED_ID in
enum pkcs11_mechanism_id.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Rev

ta: pkcs11: add vendor mechanism used for object import

Add PKCS11_PROCESSING_IMPORT and PKCS11_CKM_UNDEFINED_ID in
enum pkcs11_mechanism_id.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

ta: pkcs11: add attributes/class/key type IDs in TA API

Add attributes/class/key type IDs in TA API.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Reviewed-by: Rouven Czerwinski <r.czerwinski

ta: pkcs11: add attributes/class/key type IDs in TA API

Add attributes/class/key type IDs in TA API.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

ta: pkcs11: add object attribute ABI in TA header file

Define the ABI used to exchange attributes and lists of attributes
between the PKCS11 TA and its client.

Reviewed-by: Ricardo Salveti <ricardo

ta: pkcs11: add object attribute ABI in TA header file

Define the ABI used to exchange attributes and lists of attributes
between the PKCS11 TA and its client.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutee, ldelf: add leading underscore to syscall wrappers

libutee defines assembler wrapper functions for each OP-TEE system call.
These wrappers have a utee_ prefix. This commit adds a leading
und

libutee, ldelf: add leading underscore to syscall wrappers

libutee defines assembler wrapper functions for each OP-TEE system call.
These wrappers have a utee_ prefix. This commit adds a leading
underscore so that the names cannot clash with user-defined symbols.
Doing so is common practice for "system" libraries, as defined by the C
standard in a set of requirements that can be summarized as follows
(excerpt from the GNU libc documentation [1]):

[R]eserved names include all external identifiers (global functions
and variables) that begin with an underscore (‘_’) and all identifiers
regardless of use that begin with either two underscores or an
underscore followed by a capital letter are reserved names. This is so
that the library and header files can define functions, variables, and
macros for internal purposes without risk of conflict with names in
user programs.

The utee_*() wrappers are internal to OP-TEE and are not supposed to be
called directly by TAs so this should not have any user-visible impact.

Link: [1] https://www.gnu.org/software/libc/manual/html_node/Reserved-Names.html
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

TA dev kit: clang: link shared libraries with -z separate-loadable-segments

ldelf crashes with the following assertion when trying to load a shared
library built with Clang 10 (Clang 9 works fine):

TA dev kit: clang: link shared libraries with -z separate-loadable-segments

ldelf crashes with the following assertion when trying to load a shared
library built with Clang 10 (Clang 9 works fine):

E/LD: assertion 'seg->flags & PF_W' failed at ldelf/ta_elf.c:551 in adjust_segments()

The reason is, the virtual addresses of the PT_LOAD segments are always
paged-aligned with Clang 9 while they are not with Clang 10. Luckily,
ld.lld version 10 has introduced a new flag: -z separate-loadable-segments
[1]. Let's use this flag when supported.

Link: [1] https://manpages.debian.org/experimental/lld-10/ld.lld-10.1.en.html#separate-loadable-segments
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: Add missing default of user-ta-version

When a user TA is built with the TA dev kit (out-of-tree TA),
user-ta-version is always set to the value of CFG_TA_VERSION (default:
0) by ta_dev_kit.mk. B

ta: Add missing default of user-ta-version

When a user TA is built with the TA dev kit (out-of-tree TA),
user-ta-version is always set to the value of CFG_TA_VERSION (default:
0) by ta_dev_kit.mk. But for in-tree TAs, this variable is never set
outside the in-tree TA makefiles (ta/*/user_ta.mk). Therefore it is
mandatory for in-tree user TAs to set the variable or various issues
will happen (build error or unexpected version taken from the TA that
happened to have been built just before).

To address the problem and for consistency this commit sets a default
value of 0 for user-ta-version in ta/mk/build-user-ta.mk before
including user_ta.mk.

Fixes: 682f256caaf6 ("TA dev kit: expose CFG_TA_VERSION build option")
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

Allow use of cc-option in core/arch/arm/arm.mk

It can be useful to call the cc-option macro when setting flags in
core/arch/arm/arm.mk. Unfortunately cc-option is defined in
mk/compile.mk which is t

Allow use of cc-option in core/arch/arm/arm.mk

It can be useful to call the cc-option macro when setting flags in
core/arch/arm/arm.mk. Unfortunately cc-option is defined in
mk/compile.mk which is too late to be useful (core/arch/arm/arm.mk is
included by core/core.mk before mk/compile.mk).

This commit addresses the issue by moving the definition of cc-option
to its own file, mk/cc-option.mk, which is then included by
core/arch/arm/arm.mk. There is a dependency on the compiler definitions
(mk/gcc.mk or mk/clang.mk) and on $(arch-bit-$(sm)) so
core/arch/arm/arm.mk is modified accordingly.

Moving cc-option out of mk/compile.mk means that all non-core
submodules would lose the definition unless they include
mk/cc-option.mk; the TA dev kit is modified so that TAs can call
cc-option from within their sub.mk files. As for other submodules, they
are internal and do not use cc-options as of now so they are not
modified.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

link.mk: add missing $libgcc to ldargs

Add missing $libgcc arg to ldargs for ldelf, ta link.mk and ta
link_shlib.mk. This is required for the AOSP clang build to fix compile
errors like below:

ld.l

link.mk: add missing $libgcc to ldargs

Add missing $libgcc arg to ldargs for ldelf, ta link.mk and ta
link_shlib.mk. This is required for the AOSP clang build to fix compile
errors like below:

ld.lld: error: undefined symbol: __aeabi_mem*

Signed-off-by: Victor Chong <victor.chong@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

ta: simple typo fixes in comments in ta/pkcs11 tree

* changed "a input" to "an input" in pcks11_ta.h
* changed "the the" to "if the" in handle.c

Signed-off-by: Markus S. Wamser <github-dev@mail2013

ta: simple typo fixes in comments in ta/pkcs11 tree

* changed "a input" to "an input" in pcks11_ta.h
* changed "the the" to "if the" in handle.c

Signed-off-by: Markus S. Wamser <github-dev@mail2013.wamser.eu>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: add early TA to seal and unseal Linux trusted keys

This patch adds an early TA which acts as Linux TEE bus device to
provide a service of sealing/unsealing of trusted keys in case platform
doesn

ta: add early TA to seal and unseal Linux trusted keys

This patch adds an early TA which acts as Linux TEE bus device to
provide a service of sealing/unsealing of trusted keys in case platform
doesn't posses a TPM device or like.

To do sealing/unsealing we use system pseudo TA service to derive a
hardware unquie key to perform authenticated encryption/decryption
(using TEE_ALG_AES_GCM algo).

Also, this early TA only accepts login with a new private login method
specifically used by REE kernel (TEE_LOGIN_REE_KERNEL).

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

ta: pksc11: update for trace and command exit

Use character flag '#' instead of plain "0x" prefix.

Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jerome Forissier <jerome

ta: pksc11: update for trace and command exit

Use character flag '#' instead of plain "0x" prefix.

Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

ta: pkcs11: rename PKCS11_UNAVAILABLE_INFORMATION

Rename PKCS11_UNAVAILABLE_INFORMATION to PKCS11_CK_UNAVAILABLE_INFORMATION
as it relates to Cryptoki CK_UNAVAILABLE_INFORMATION identifier.

Reviewe

ta: pkcs11: rename PKCS11_UNAVAILABLE_INFORMATION

Rename PKCS11_UNAVAILABLE_INFORMATION to PKCS11_CK_UNAVAILABLE_INFORMATION
as it relates to Cryptoki CK_UNAVAILABLE_INFORMATION identifier.

Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
[jw: fixup PKCS11_UNDEFINED_ID]
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: token_capabilities.h: add missing includes

Adds missing includes in token_capabilities.h.

Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jerome Forissier <jer

ta: pkcs11: token_capabilities.h: add missing includes

Adds missing includes in token_capabilities.h.

Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: replace complicated params pointer calculation

Replaces params pointer calculations on the form
ctrl = &params[0];
out = &params[2];
with a plain
ctrl = params;
out = params + 2;
in all

ta: pkcs11: replace complicated params pointer calculation

Replaces params pointer calculations on the form
ctrl = &params[0];
out = &params[2];
with a plain
ctrl = params;
out = params + 2;
in all entry function still using this form.

Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: use enum pkcs11_rc instead of uint32_t

Uses enum pkcs11_rc instead of uint32_t where appropriate, that is, as
function return type and local return value type.

Reviewed-by: Rouven Czerw

ta: pkcs11: use enum pkcs11_rc instead of uint32_t

Uses enum pkcs11_rc instead of uint32_t where appropriate, that is, as
function return type and local return value type.

Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: use serialargs_get_session_from_handle()

Change command processing entry functions to use helper function
serialargs_get_session_from_handle() to get session from the
session handle seri

ta: pkcs11: use serialargs_get_session_from_handle()

Change command processing entry functions to use helper function
serialargs_get_session_from_handle() to get session from the
session handle serialized input argument instead of the 2 step
serialargs_get()/pkcs11_handle2session().

No functional change as current functions always first checked
session validity prior other arguments validity, assuming client
arguments were well serialized.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: helper function to get session from serial arguments

Add helper function serialargs_get_session_from_handle() to get
session instance from a 32bit session handle value in the
client seri

ta: pkcs11: helper function to get session from serial arguments

Add helper function serialargs_get_session_from_handle() to get
session instance from a 32bit session handle value in the
client serialized arguments.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: set default token serial number based on token ID

With this change, token serial number is string "0...0000000<N>" over
16 characters, led with '0' and ending with token ID decimal value

ta: pkcs11: set default token serial number based on token ID

With this change, token serial number is string "0...0000000<N>" over
16 characters, led with '0' and ending with token ID decimal value.

It is common for the client application to decide the slot to use
based on the token serial number. Therefore change the default value
to be based on the token ID to avoid having the same serial numbers
on every token.

Co-developed-by: Ricardo Salveti <ricardo@foundries.io>
Signed-off-by: Ricardo Salveti <ricardo@foundries.io>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
[jf: cast sizeof() to int in snprintf() with field with specifier '*']
Signed-off-by: Jerome Forissier <jerome@forissier.org>

show more ...

ta: pkcs11: set slot information to gpd.tee.deviceID if available

Use gpd.tee.deviceID to provide a device specific UUID as part of the
slot information (field with enough size for UUID).

Co-develo

ta: pkcs11: set slot information to gpd.tee.deviceID if available

Use gpd.tee.deviceID to provide a device specific UUID as part of the
slot information (field with enough size for UUID).

Co-developed-by: Ricardo Salveti <ricardo@foundries.io>
Signed-off-by: Ricardo Salveti <ricardo@foundries.io>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>

show more ...

ta: pkcs11: remove unused variable token in entry_ck_slot_info()

Remove unused variable token in entry_ck_slot_info().
No functional change.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro

ta: pkcs11: remove unused variable token in entry_ck_slot_info()

Remove unused variable token in entry_ck_slot_info().
No functional change.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>

show more ...

ta: pkcs11: remove unused PIN encryption key functions

PINs are hashed with a salt instead of being encrypted with a secret
key. So remove the now unused management of these secret keys.

Acked-by:

ta: pkcs11: remove unused PIN encryption key functions

PINs are hashed with a salt instead of being encrypted with a secret
key. So remove the now unused management of these secret keys.

Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: implement commands PKCS11_CMD_LOGIN/_LOGOUT

Implements login/logout support.

Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Co-developed-by: Etienne Carriere <etienne.carrier

ta: pkcs11: implement commands PKCS11_CMD_LOGIN/_LOGOUT

Implements login/logout support.

Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...